Skip to content
Vault Studio Pro
Menu

Security

How Vault Studio Pro keeps your files on your device

This page explains, as precisely as we can, what happens to your files, what our server sees, and where the limits are. Where something can leave your device, we say so.

1. Your files are processed in the browser

Vault Studio Pro is a web app made of JavaScript and WebAssembly. When you open a file, your browser reads it from your disk into the page's memory. The editors, the PDF engine (pdf.js and pdf-lib), text recognition (Tesseract), image processing and encryption all run inside that page. When you save, the browser writes a new file to your downloads. There is no conversion server, and your document isn't sent anywhere to be processed.

2. The browser blocks connections to other sites

Every page is served with a Content-Security-Policy, a set of rules that your browser enforces on the page. The rule that matters most is:

connect-src 'self' data: blob:

It means that scripts on the page can only make network connections (fetch, XHR, WebSocket, EventSource) to our own domain. A connection to any other website is refused by the browser before it is made, even if a bug in our code, a compromised library or a booby-trapped document tried to send your data elsewhere. The policy also stops the page from loading images or media from other sites, so a document can't contain a tracking pixel, and it only allows scripts that come from our own domain.

What the policy does not do:

  • It doesn't restrict connections to our own domain. Those are limited to the app's own files and the two license calls described below. You can check them with the Privacy Audit.
  • It doesn't stop you from clicking an ordinary link or saving a file somewhere you choose, such as a synced cloud folder.
  • It can't protect you from malware or browser extensions already running on your computer.

3. Nothing is loaded from third parties

Fonts, the pdf.js character maps and standard fonts, and the OCR engine and its English language data are all served from our own domain rather than from a public CDN or Google Fonts. The pages contain no analytics, advertising or tracking scripts, and set no tracking cookies.

4. Check it yourself with the Privacy Audit

The app includes a Privacy Audit panel. It shows the browser's own record of every request the page has made (collected with the browser's Resource Timing API, including requests from before you opened the panel), and it lists anything the Content-Security-Policy blocked.

Its limit: it lists the page's own requests, not those made by background workers, such as the OCR and PDF workers. To see absolutely everything, open your browser's developer tools, go to the Network tab, and use the app. The panel tells you how.

5. The only calls to our server

Apart from downloading the app's own files, the app talks to our server in exactly two situations:

  1. Claiming a license after checkout. When Stripe sends you back to the app after a purchase, the app sends the Stripe checkout session ID to /api/license/claim and receives your license key.
  2. Refreshing a subscription key. Near the end of a subscription's billing period, the app sends the license key to /api/license/renew to get an updated key. This only happens for subscriptions, only in the last few days before the key expires, and at most once a week after a subscription has ended.

Neither request contains your documents, file names or anything about how you use the app. Our license server reads the Stripe order details needed to issue the key (the plan, its dates, and the name or email you gave Stripe, which is written into the key as the licensee) and sees the license key itself.

6. License keys are verified offline

A license key is a small signed statement of your plan and its dates. The app checks the signature with an ECDSA (P-256, SHA-256) public key built into the app, so verifying a key needs no network connection and no account. Only the matching private key, which is never in the app, can create valid keys. Keys for orders that were refunded or charged back can be revoked.

7. Storage: in your browser, not encrypted at rest

Projects you work on are autosaved in your browser's storage on this device (IndexedDB and localStorage), so they survive a refresh. That storage is not encrypted by the app. Anyone who can use your browser profile can open those projects, and clearing site data deletes them. On a shared or public computer, export your files and delete the projects when you are done. The Privacy Audit shows how many projects are stored.

The full backup export (.vaultbackup) is plain, unencrypted JSON. Store it as carefully as the documents themselves, or put it in an encrypted .vault first.

8. Encrypted .vault files

When you export a project as an encrypted .vault, or lock any file in the File Safe, the app uses the browser's Web Crypto API:

  • AES-GCM with a 256-bit key and a random 96-bit nonce (authenticated encryption, so tampering is detected).
  • The key is derived from your password with PBKDF2-SHA-256, 600,000 iterations (OWASP's current recommendation) and a random 128-bit salt per file.
  • The file's name, type and size are encrypted along with the file — only a format tag and a timestamp are visible on the outside.

The password never leaves your device, and we can't recover a forgotten one. The protection is only as strong as the password: use a long, unique passphrase. Read more on the File Safe page.

9. Dictation uses your browser's speech service

Dictation in Docs uses the speech recognition built into your browser. In Chrome the audio is sent to Google, and in Safari to Apple, under their privacy policies. That is outside our control and outside the Content-Security-Policy, because the browser does it, not the page. The app asks for your permission before it starts. Read aloud (text-to-speech) uses your browser's voices. Everything else in the app processes your files on your device.

10. Redaction

PDF redaction replaces each redacted page with an image of the page with the boxes burned in, so the underlying text and graphics are removed from the file rather than covered. See how PDF redaction works.

11. What we can't promise

  • We serve the app, so you are trusting the code we send you, as with any web app. The Content-Security-Policy and the Privacy Audit let you verify its behaviour, rather than asking you to take our word for it.
  • Browser extensions you install can read pages you visit, including this one.
  • A file you save to a synced folder (iCloud, Dropbox, OneDrive and so on) is synced by that service.

Reporting a security issue

If you find a vulnerability, please email support@vaultstudiopro.com with details, and give us a reasonable time to fix it before you disclose it.